If you're a principal, corporation clerk or board member at a further education (FE) college in Wales, this is a practical guide to what Martyn's Law means for your institution, who is legally responsible, what you actually need to do and what you can safely set aside. 

Key points at a glance:

• Most FE colleges in Wales are in scope.
• FE settings remain in the standard tier regardless of capacity - enhanced duties don't apply.
• Standard-tier requirements focus on documented procedures and staff training, not physical security infrastructure.
• The responsible person is the FE corporation board.
• Multi-campus institutions must assess each site individually against the 200-person threshold.
• The compliance deadline is expected to be spring 2027, but the requirements are clear now.
• Welsh Government, Medr and Colegau Cymru are the bodies to watch for sector-specific guidance - not the DfE.
• Official guidance and free resources are available. There's no need to buy third-party compliance products before reading them.

If you're a principal, corporation clerk or board member reading this, there is a lot to cover. Martyn's Law applies across the UK, but the context in which you're operating is different from England.

When does Martyn's Law take effect?

Martyn's Law, formally the Terrorism (Protection of Premises) Act 2025, came into force on 3 April 2025. The government has committed to an implementation period of at least 24 months before duties become legally enforceable, which puts the compliance deadline in spring 2027. 

You are not yet legally required to comply. The complexity of the exercise for a multi-campus FE institution means now is the right time to start, not spring 2027.

What is Martyn's Law and why does it exist?

The Act takes its name from Martyn Hett, one of the 22 people killed in the Manchester Arena bombing in 2017. It exists because of years of campaigning by his mother, Figen Murray OBE to ensure venues implement counterterrorism and security preparedness and have actionable plans in the event of incidents. 

It’s worth holding on to that, even when compliance starts to feel like another item on an already unreasonable to-do list.

Which FE colleges in Wales are in scope?

The Act uses a tiered system based on the number of people reasonably expected to be present at a premises at the same time. Most FE colleges will comfortably meet the 200-person threshold on any ordinary day once students, staff and visitors are counted together.

Further education settings benefit from a specific consideration in the Act, meaning they remain in the standard tier regardless of their capacity. Enhanced duty requirements do not apply to them. That has been a source of uncertainty for some colleges, particularly larger institutions with significant footfall. It need not be. You are in the standard tier. That is a meaningful protection, and you should note it clearly in your governance documentation.

Settings where fewer than 200 people are reasonably expected to be present at the same time fall outside scope, though the government encourages all settings to have preparedness plans in place regardless.

The multi-campus question for FE colleges in Wales

Many FE institutions in Wales operate across more than one site, and this is where the exercise becomes more complex than most guidance acknowledges. Each premises is assessed on its own expected occupancy, separately. 

A satellite centre with 60 part-time learners and a small staff team may fall below 200 and sit outside scope entirely. The main campus of the same institution will almost certainly not.

That means an FE corporation operating across multiple sites in Wales needs to assess each site individually, document its reasoning for each, and build a clear picture of which sites are in scope and which are not. 

The answer will vary, and the analysis needs to be site-specific. Do not let the complexity become a reason to delay starting. Document as you go and build a whole-corporation picture from there.

How to calculate occupancy for FE colleges

For a secondary school, expected occupancy on a given day is relatively straightforward. For an FE college in Wales, considerably less so. Part-time learners, adult education and community learning programmes, employer-based delivery, Welsh-medium provision, evening classes and seasonal variation in attendance all mean that "reasonably expected to be present at the same time" requires genuine and careful analysis. 

That analysis should be grounded in timetabling data rather than headline enrolment numbers. The SIA may ask how you arrived at your occupancy figure, and it should be a documented calculation with a clear methodology. This is worth investing time in now, before any compliance deadline.

What do FE colleges in Wales actually need to do to comply?

All settings within scope must, so far as is reasonably practicable, have public protection procedures in place covering evacuation, invacuation, lockdown and communication. These are procedures to enable staff to act quickly to reduce harm in the event of a terrorist incident at or near the premises. "So far as is reasonably practicable" is a legal standard familiar from health and safety law. 

It's a framework for proportionality, and proportionality still has expectations built into it. Colleges that have engaged seriously with Estyn inspection preparation will recognise the underlying discipline: documented, evidenced, tested and known to staff. Martyn's Law asks for exactly that but applied to public protection procedures specifically.

For most FE colleges in Wales, the investment required will be primarily of time and review rather than capital expenditure. One point worth highlighting specifically for FE, standard-tier settings are not required to appoint a designated senior individual ('DSI') with personal statutory responsibilities. If you have been reading guidance aimed at a general audience and wondering whether a DSI is on your list, it is not.

Responsible persons at all qualifying premises must notify the SIA as regulator. A ‘responsible person’ is the individual or organisation that has overall control of qualifying premises or events.

The online portal is not yet live. When it does open, notification should be approved and submitted as an act of the responsible person, which for FE corporations means board approval. Noted, clerked and minuted.

Martyn's Law in Wales: Medr, Estyn and the regulatory landscape

Martyn's Law is reserved legislation, which means that the UK Government legislates for it and it applies across the UK. But the compliance environment in which you operate, including your governance framework, your relationship with Welsh Government, your Prevent duty obligations as they apply in Wales and your Welsh-medium delivery obligations, is distinctly Welsh. The interaction between Martyn's Law and those existing obligations is worth working through carefully.

As FE colleges in Wales are regulated and funded by Medr, the funding relationship, the oversight framework and the accountability architecture are different, and that has practical implications for how Martyn's Law sits alongside your existing regulatory obligations.

Estyn, the inspectorate for education and training in Wales, already requires colleges to demonstrate robust procedures, evidenced practice and staff awareness across a range of areas. 

The discipline that Martyn's Law imposes, documented procedures that staff actually know and can act on, is not unfamiliar territory for any college that has been through an Estyn inspection cycle. That is worth recognising. You are not learning a new language here, you are applying an existing capability to a specific legal framework.

The DfE has been running free webinars for education settings in England during the implementation period. Those, however, are not aimed at you. Welsh Government and Medr are the bodies to watch for guidance, communications and support specific to the Welsh FE sector. Colegau Cymru, the representative body for FE colleges in Wales, is also a useful source of sector-specific intelligence.

Who is legally responsible? Governance for FE corporations

For FE corporations, the corporation (the Board) itself is the responsible person. In practical terms, that means the corporation board carries this obligation as a matter of law, in the same way it carries financial duties and strategic responsibilities. 

Principals should be bringing this to the board for the board to own. Briefing the board after the decisions have been made is not the same as the board discharging its legal duty.

For colleges operating across multiple campuses, site-specific procedures will be needed, but they must be governed, monitored and evidenced at a whole-corporation level. The principal implements. The board owns. That distinction is worth making explicit at board level before spring 2027.

How does Martyn's Law affect FE college lettings in Wales?

FE institutions in Wales tend to have more complex commercial exposure here than most schools. Colleges with conference suites, sports centres, catering operations open to the public and employer training facilities need to consider each of those uses separately.

As a general rule, where your premises are hired for an event, responsibility as the qualifying premises operator remains with you unless responsibility has been clearly allocated elsewhere in writing. If your conference suite is let to an external organiser for a public event attracting 400 delegates, the question of who holds responsibility under the Act needs to be answered in your lettings agreement, not assumed. 

We recommend reviewing template lettings agreements now, identifying any events that might attract 200 or more attendees and taking advice on how responsibility is properly allocated. A practical step, achievable before the end of this academic year, that will save a less comfortable conversation later. 

Do you need to buy Martyn's Law compliance products?

The market for compliance products has grown rapidly since royal assent, and not all of it is selling something the Act actually requires. The SIA, the Home Office and ProtectUK have all confirmed they don't endorse any third-party products or providers claiming to ensure compliance with Martyn's Law. Before commissioning third-party services, start with the official guidance. 

The best free resources are:

• ProtectUK (protectuk.police.uk): Practical guidance and free e-learning on protective security.
• National Protective Security Authority (npsa.gov.uk): Threat assessments and security advice.
• Attend the free sessions and read the official material first: If you still feel you need external support afterwards, at least you'll know what you're buying.

What will an SIA inspection look like?

The SIA has signalled a proportionate, advisory-first approach. Think of it as a professional conversation about whether your documented procedures are in place, understood by your staff and capable of being acted on quickly. 

The Home Office published its final section 27 statutory guidance on 15 April 2026, and the requirements are now clearly set out. That said, proportionality has its limits. 

The Act gives the SIA powers to issue civil notices and financial penalties, and in the most serious cases to refer matters for prosecution. A college with no documented procedures, no evidence of staff training and no record of engagement with the guidance isn't going to find that conversation particularly comfortable.

Upcoming regulatory guidance

The SIA's draft section 12 guidance on how it will exercise its regulatory functions is currently being finalised following public consultation. Once published, it will give the clearest picture yet of what an inspection will look like in practice. Watch for it and sign up for SIA email updates if you haven't already.

Where should you start? A practical checklist for FE colleges in Wales

The most useful first steps are:

• Have a governance conversation: Make sure your corporation board understands that it is the responsible person as a matter of law and is prepared to own that responsibility at a whole-corporation level.
• Assess each campus individually: Document the occupancy calculation for every site, grounded in timetabling data, and build a clear picture of which sites are in scope and which are not.
• Audit what you have: Work through your existing procedures and compare them against the Home Office statutory guidance.
• Identify real gaps: The question to ask of each procedure isn't just whether it exists, but whether it's current, whether it reflects the Act's specific requirements and whether your staff actually know what to do.
• Review your lettings agreements: Identify any events that might attract 200 or more attendees and take advice on how responsibility under the Act is properly allocated between you and the hirer.
• Watch for Welsh-specific guidance: Sign up for updates from Medr, Welsh Government and Colegau Cymru rather than relying on DfE communications aimed at settings in England.
• Don't wait: The requirements are clear, the obligations are manageable and the implementation period exists to give you time to prepare properly - not to defer the work.

For most FE colleges in Wales, the honest assessment is that this is achievable now, with the staff, documentation and procedures you largely already have.

Why this matters

Martyn's Law doesn't ask further education institutions to do anything that is alien to good leadership. Looking after the people in your care, planning carefully for difficult situations, making sure your staff know what to do - those things are already at the heart of what you do every day. The Act gives those responsibilities a formal legal framework and places accountability clearly where it belongs.

FE in Wales serves some of the most diverse communities in the UK, including communities where the opportunities FE provides are genuinely life changing. Ensuring protective planning is at the core of Martyn's Law.

At Browne Jacobson, we work with further education institutions across England and Wales on the full range of legal questions that arise in the sector. Martyn's Law cuts across governance, health and safety, employment and commercial law, and it is an area our education and regulatory teams are following closely.

If you would like to talk through what it means for your college or corporation, please do get in touch.